order powershell_script

2021-10-09 10:30:36 +02:00
parent 77749510b7
commit 5c68c42058
39 changed files with 2 additions and 1 deletions
@@ -0,0 +1,25 @@
+title: Dnscat Execution
+id: a6d67db4-6220-436d-8afc-f3842fe05d43
+description: Dnscat exfiltration tool execution
+status: experimental
+author: Daniil Yugoslavskiy, oscd.community
+date: 2019/10/24
+modified: 2020/08/24
+tags:
+    - attack.exfiltration
+    - attack.t1048
+    - attack.execution
+    - attack.t1059.001
+    - attack.t1086  # an old one
+logsource:
+    product: windows
+    service: powershell
+    definition: Script block logging must be enabled
+detection:
+    selection:
+        EventID: 4104
+        ScriptBlockText|contains: "Start-Dnscat2"
+    condition: selection
+falsepositives:
+    - Legitimate usage of PowerShell Dnscat2 — DNS Exfiltration tool (unlikely)
+level: critical